<epigraph>
  <attribution>Norm Schryer</attribution>
  <simpara>
    If the code and the comments disagree, then both are probably wrong.
  </simpara>
</epigraph>

<simpara>
  In <xref linkend="one.step.closer"/> we inserted code into the gap
  between code and data segment. This loophole is rather small.
  And even worse, it is not too hard to check whether it is occupied.
  I still have no cure for that. Read the trail of my wrath.
</simpara>
<simpara>
  Well, just kidding. But mindless rage is a good excuse for
  actions that are doomed from the start. Of course my
  <link linkend="turn.the.pages">pestiferous piece of Perl</link>
  will detect the result of this chapter
  (<quote>has 3 LOAD segments</quote>).
  But then even the untrained eye can spot the difference
  in the output of
  <citerefentry>
    <refentrytitle>readelf</refentrytitle>
    <manvolnum>1</manvolnum>
  </citerefentry>.
  So why is this done at all?
</simpara>
<simpara>
  Because the method is very simple to implement and imposes no size
  limit on the code.
</simpara>

<sect2 id="magic.of.the.gnu" xreflabel="Magic of the GNU">
  <title>Magic of the GNU</title>

  <simpara>
    Have a look at
    <citerefentry>
      <refentrytitle>readelf</refentrytitle>
      <manvolnum>1</manvolnum>
    </citerefentry>'s
    <link linkend="bashful.glance">output</link> on
    <filename>/bin/sh</filename>.
    The last program header is of type <literal>NOTE</literal>
    and has exactly &calc.infe1.NOTE1.filesiz.X; bytes.
    So what's in there?
  </simpara>

  <formalpara>
    <title>Command: src/additional_cs/hexdump.sh</title>
    <para>
      <programlisting><inlinemediaobject><imageobject><imagedata
        format="linespecific"
	fileref="../../src/additional_cs/hexdump.sh"
      /></imageobject></inlinemediaobject></programlisting
    ></para
  ></formalpara>
  <formalpara>
    <title>Output: &config.OUT;/additional_cs/hexdump</title>
    <para>
      <programlisting><inlinemediaobject><imageobject><imagedata
        format="linespecific"
	fileref="../../&config.OUT;/additional_cs/hexdump"
      /></imageobject></inlinemediaobject></programlisting
    ></para
  ></formalpara>

  <simpara>
    It's the magic of the GNU.
    In this special case we can live without.
    But it's still interesting what <acronym>LSB</acronym>
    <footnoteref linkend="note.lsb"/> has to say about it:
    &note.lsb.noteabitag;
  </simpara>
  <blockquote>
    <simpara>
      Every executable shall contain a section named
      <literal>.note.ABI-tag</literal> of type
      <literal>SHT_NOTE</literal>. This section is structured as a
      note section as documented in the <acronym>ELF</acronym> spec.
      The section must contain at least the following entry. The
      name field (<varname>namesz</varname>/<varname>name</varname>)
      contains the string <literal>"GNU"</literal>. The type field
      shall be 1. The <literal>descsz</literal> field shall be at
      least 16, and the first 16 bytes of the <literal>desc</literal>
      field shall be as follows.
    </simpara>
    <simpara>
      The first 32-bit word of the <varname>desc</varname> field
      must be 0 (this signifies a Linux executable). The second,
      third, and fourth 32-bit words of the <varname>desc</varname>
      field contain the earliest compatible kernel version.
      For example, if the 3 words are 2, 2, and 5, this signifies a
      2.2.5 kernel.
    </simpara>
  </blockquote>

</sect2>
<sect2>
  <title>A simple plan</title>

  <procedure>
    <step>
      <simpara>
	Overwrite program header of type of <literal>NOTE</literal>
        with a code segment definition (type <literal>LOAD</literal>).
      </simpara>
    </step>
    <step>
      <simpara>Append virus code at end of file.</simpara>
    </step>
  </procedure>

  <simpara>
    Having just &calc.infection.size.D; bytes,
    <link linkend="target.infection">our unrealistic code</link>
    is small enough to fit into the <literal>NOTE</literal> segment.
    But let's pretend this is a real example.
    I will reuse the framework from <xref linkend="one.step.closer"/>.
  </simpara>

</sect2>
<sect2>
  <title>patchPhdr</title>

  <simpara>
    Double infection is
    <link linkend="patching.program.headers">again</link>
    impossible by design. If there is no <literal>PT_NOTE</literal>
    this target is out of reach.
  </simpara>

  <formalpara>
    <title>Source: src/additional_cs/patch_phdr.inc</title>
    <para>
      <programlisting><inlinemediaobject><imageobject><imagedata
        format="linespecific"
	fileref="../../src/additional_cs/patch_phdr.inc"
      /></imageobject></inlinemediaobject></programlisting>
    </para>
  </formalpara>

</sect2>
<sect2>
  <title>newEntryAddr</title>

  <simpara>
    We can use any memory region not already occupied.
    Using one below the magic base of &calc.base.addr; avoids trouble.
    See <xref linkend="INFECTION.SIZE"/> for an explanation of
    <literal>% 0x1000</literal>.
  </simpara>
  <formalpara>
    <title>Source: src/additional_cs/new_entry_addr.inc</title>
    <para>
      <programlisting><inlinemediaobject><imageobject><imagedata
        format="linespecific"
	fileref="../../src/additional_cs/new_entry_addr.inc"
      /></imageobject></inlinemediaobject></programlisting>
    </para>
  </formalpara>

</sect2>
<sect2>
  <title>patchShdr</title>

  <simpara>
    Not implemented. To cover the bytes of the new <literal>LOAD</literal>
    segment with a section we would have to insert a new one in the
    array of section headers. Right now I'm not in the mood
    to invest so much time in a hopeless case.
  </simpara>
  <formalpara>
    <title>Source: src/additional_cs/patch_shdr.inc</title>
    <para>
      <programlisting><inlinemediaobject><imageobject><imagedata
        format="linespecific"
	fileref="../../src/additional_cs/patch_shdr.inc"
      /></imageobject></inlinemediaobject></programlisting>
    </para>
  </formalpara>

</sect2>
<sect2 id="copy.and.infect.v2">
  <title>copyAndInfect</title>

  <formalpara>
    <title>Source: src/additional_cs/copy_and_infect.inc</title>
    <para>
      <programlisting><inlinemediaobject><imageobject><imagedata
        format="linespecific"
	fileref="../../src/additional_cs/copy_and_infect.inc"
      /></imageobject></inlinemediaobject></programlisting>
    </para>
  </formalpara>

</sect2>
<sect2 id="to.serve.and.detect">
  <title>To serve &amp; detect</title>

  <formalpara>
    <title>Output: &config.OUT;/additional_cs/cc</title>
    <para>
      <programlisting><inlinemediaobject><imageobject><imagedata
        format="linespecific"
	fileref="../../&config.OUT;/additional_cs/cc"
      /></imageobject></inlinemediaobject></programlisting>
    </para>
  </formalpara>

  <formalpara>
    <title>Output: &config.OUT;/additional_cs/test</title>
    <para>
      <programlisting><inlinemediaobject><imageobject><imagedata
        format="linespecific"
	fileref="../../&config.OUT;/additional_cs/test"
      /></imageobject></inlinemediaobject></programlisting>
    </para>
  </formalpara>

  <simpara>
    The method works, but is not safe to
    <citerefentry>
      <refentrytitle>strip</refentrytitle>
      <manvolnum>1</manvolnum>
    </citerefentry>.
    Well, on to
    <citerefentry>
      <refentrytitle>readelf</refentrytitle>
      <manvolnum>1</manvolnum>
    </citerefentry>.
    Compare it with <link linkend="bashful.glance">the original</link>.
  </simpara>

  <formalpara>
    <title>Output: &config.OUT;/additional_cs/segments</title>
    <para>
      <programlisting><inlinemediaobject><imageobject><imagedata
        format="linespecific"
	fileref="../../&config.OUT;/additional_cs/segments"
      /></imageobject></inlinemediaobject></programlisting>
    </para>
  </formalpara>

  <simpara>
    File size grew &calc.additional.cs.size.D; - &calc.sh.size.D; =
    &calc.additional.cs.size.delta.D; bytes.
    But even an unmodified entry point is pointless in this case.
    Anybody can notice <literal>LOAD</literal> instead of
    <literal>NOTE</literal>.
  </simpara>

  <formalpara>
    <title>Command: src/additional_cs/scan_dist.sh</title>
    <para>
      <programlisting><inlinemediaobject><imageobject><imagedata
        format="linespecific"
	fileref="../../src/additional_cs/scan_dist.sh"
      /></imageobject></inlinemediaobject></programlisting>
    </para>
  </formalpara>
  <formalpara>
    <title>Output: &config.OUT;/additional_cs/scan</title>
    <para>
      <programlisting><inlinemediaobject><imageobject><imagedata
        format="linespecific"
	fileref="../../&config.OUT;/additional_cs/scan"
      /></imageobject></inlinemediaobject></programlisting>
    </para>
  </formalpara>

  <simpara>Case closed. Guilty of failure.</simpara>

</sect2>
